CVE Vulnerability Catalog

Apache Traffic Server mishandles on-disk cache fields and object lifetimes, corrupting state or crashing. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

Apache Traffic Server can crash from null dereferences and dangling references in TLS and SNI handling. This affects versions from 8.0.0 through 8.1.11, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3. Users are recommended to upgrade to 9.2.15 or 10.1.4.

Apache Traffic Server can bypass IP access controls on UDS listeners and through ACL matching errors. This affects versions from 8.0.0 through 8.1.11, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3. Users are recommended to upgrade to 9.2.15 or 10.1.4.

Apache Traffic Server can reuse server sessions and tunnels improperly, exposing data across client connections. Affected versions are from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, and from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4.

In Apache Atlas, missing authorization in admin endpoints allows any authenticated user, regardless of role, to perform administrative operations.

Kyuubi Engine UI proxy accepts a host and port from the request path and proxies HTTP requests to that destination. A remote attacker with network access can cause SSRF or open-proxy behavior.

Apache Traffic Server drops the per-stream buffer cap when dechunking HTTP/2 or HTTP/3 responses, letting a slow client exhaust server memory. This affects versions from 8.0.0 through 8.1.11, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3. Users are recommended to upgrade to 9.2.15 or 10.1.4.

In the Linux kernel's Bluetooth L2CAP stack, a use-after-free vulnerability exists in l2cap_sock_new_connection_cb(). After releasing the parent lock, a child socket can be accepted and freed by another thread before dereference, leading to use-after-free.

In the Linux kernel, a vulnerability was found in the perf event group management. Removing events via perf_event_remove_on_exec() can leave an inconsistent group state when a group leader is removed while sibling events remain active. This corrupts the PMU context active list and can cause a double list addition.

Apache Traffic Server can write out of bounds or overflow integers while parsing MIME and HTTP headers. Affected versions are from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, and from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4.

Apache Traffic Server forwards HTTP/2 origin trailers to HTTP/1 clients without proper chunked framing when converting HTTP/2 to HTTP/1. Affects versions 10.0.0 through 10.1.3.

Apache Traffic Server can be crashed or driven to resource exhaustion by abusive HTTP/2 framing and flow-control. Affected versions are from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, and from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4.

The Database for CF7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Array Form Field Values in all versions up to, and including, 1.2.6 due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute when a user accesses an injected page. This is exploitable because Contact Form 7 accepts array-structured input for ordinary text fields via the public REST API endpoint, and the plugin stores submitted data using $wpdb INSERT with serialize() into a custom table, bypassing WordPress save-time filtering.

HTTP Request Smuggling vulnerability in Apache Traffic Server. Affects versions 10.0.0 through 10.1.3 and 9.0.0 through 9.2.14.

A Regular Expression without Anchors vulnerability was found in Apache Traffic Server. It affects versions from 10.0.X through 10.1.3 and from 9.0.X through 9.2.14. Upgrading to version 9.2.15 or 10.1.4 fixes the issue.

A post-authentication SQL injection vulnerability was found in Koollab LMS. An authenticated attacker can use the face-to-face runs update endpoint to read the entire database and obtain valid JWT tokens for account takeover.

The miniOrange Social Login and Register WordPress plugin before 7.8.0 does not bind the one-time code used for optional email verification to the account it was issued for. This allows an unauthenticated attacker to obtain a valid session for any account, including administrators, by requesting a code for a controlled email and replaying it against the victim's email.

The WOLF WordPress plugin before 1.1.0 does not perform a nonce or capability check on one of its AJAX actions. This allows an unauthenticated attacker to trick a logged-in administrator into writing arbitrary content, including a malicious script, into a post via a cross-site request, resulting in stored Cross-Site Scripting (XSS).

The UsersWP WordPress plugin before 1.2.67 does not validate the selected authentication provider in its two-factor login handler. This allows an attacker who already knows a user's credentials to bypass the second authentication factor and log in as that user.

The wp-media-folder-addon WordPress plugin before 4.1.7 does not validate a user-supplied parameter before using it in a file read operation in two AJAX actions available to unauthenticated users, leading to Arbitrary File Disclosure and Server-Side Request Forgery on sites where a cloud storage connection has been configured. This is an incomplete fix of CVE-2026-9690, whose patch hardened only one of the affected cloud-storage handlers and left the others unpatched.